Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Windows Server 2008 R2, IIS7. We have an SSL cert from Go Daddy. It's a wildcard cert, so it will work across subdomains (e.g. *.domain.com). I followed the instructions located at http://support.godaddy.com/help/article/4801/installing-an-ssl-certificate-in-microsoft-iis-7 for installing the certificate. I get to the IIS step, where I:

  • Click on "Security Certificates" feature when the server is selected in the left pane
  • Click on "Complete Certificate Request"
  • Navigate to the .crt file on the file system
  • Give it a "friendly" name, click finish

The cert gets listed on the main pane now of this "Server Certificates" panel. But, if I refresh the page, or navigate away and come back, it's gone. And the cert is not listed as a viable binding when trying to bind a site to https.

This seems like a pretty straight forward process, but clearly I'm missing something here. Any ideas?

EDIT: I found this post, which seems to imply this behavior happens when you try to use the intermediate certificate. When I downloaded the files from GoDaddy, there were 2 in a zip file. 1 was the gd_iis_intermediates, the other was named for the domain. I installed the domain one (extension .crt). There didn't seem to be any other option - installing the other from IIS gives an error "Cannot find the certificate request that is associated with this certificate file. A certificate request must be completed on the computer where the request was created".

That being said, there doesn't appear to be any other download I can use.

There was also mention, in the comments (and elsewhere after googling) of "exporting" the cert as a pfx, and installing that. But I can't figure out how to export it - even through certmgr.msc.

I should also mention this cert is installed on another computer running IIS6 (this IIS7 installation is meant to be a failover, plus the primary while we upgrade the IIS6 to IIS7). But I can't figure out how to export it from that computer either.

share|improve this question
add comment

6 Answers

up vote 3 down vote accepted

The certificate was not exportable, so I was unable to use Roberts suggestion. Ultimately, I had to rekey the certificate at the Go Daddy account management page, and install it on both servers again. Some of the options during the wizard for the install on IIS6 were grayed out for me, and my initial attempt on that server failed. I ended up installing the certificate on the new server (IIS7), and then exporting that certificate in a .pfx format, and then importing that version into the IIS6 installation. At which point everything started working.

share|improve this answer
add comment

Try exporting the certificate from the IIS6 server using these instructions: http://www.sslshopper.com/move-or-copy-an-ssl-certificate-from-a-windows-server-to-another-windows-server.html

That will ensure that the certificate has a private key.

share|improve this answer
    
The option to export the private key is grayed out, saying it was marked as "unexportable" –  Matt Apr 15 '10 at 15:29
    
Come to think of it, the fact it was marked as unexportable is probably why this certificate didn't get migrated over during the msdeploy migration of the server ... hmm –  Matt Apr 15 '10 at 15:32
    
If you aren't able to find a server where the certificate is exportable, you will need to generate a new CSR and have GoDaddy reissue/re-key it to get a new matching certificate. –  Robert Apr 18 '10 at 4:07
add comment

try importing into Intermediate Certificate Stores. If you view the certificate there, you will find that "you have a private key that corresponds to this certificate". Simply export to .pfx, then import into IIS. Worked for me :)

share|improve this answer
add comment

I've found the problem can be reproduced when the leaf certificate has been installed under Intermediate Certification Authorities. Removing it (and leaving any real intermediate, if applicable) then completing the wizard corrects the problem.

share|improve this answer
add comment

I ran into this issue as well. Rekeying the cert resolved the issue, but the reason was that I was using a UCC cert, and the SARs had been changed AFTER the cert had last been re-keyed. Re-keying the cert again resolved the issue. I spent 2 hours on the phone with a tech there before I found that out <:(

share|improve this answer
add comment

As far as I can tell from having these issues today, if you have a certificate with multiple SANs (or I guess a wildcard) and run multiple servers, you need to rekey in Godaddy every time you install on a different machine.

This is easy enough - generate a CSR (2048 bit encryption), paste it on the Rekey page in Godaddy and you can then download a new cert. There isn't a wait for approval.

share|improve this answer
    
No, you don't need to rekey to install on different machines. Import into the machine you generated the CSR from (making sure you import the intermediate certificate before importing the .crt), then export to a .pfx and you can import into the others. –  Rory Oct 3 '13 at 9:32
add comment

protected by Michael Hampton Sep 16 '13 at 15:18

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.